【JavaWeb学习 | 第23篇】监听器、RBAC权限模型

// com.example.listener.AppListener.java
@WebListener
public class AppListener implements ServletContextListener {

    @Override
    public void contextInitialized(ServletContextEvent sce) {
        // 应用启动时执行（服务器启动或项目部署）
        ServletContext context = sce.getServletContext();
        System.out.println("【应用启动】" + context.getContextPath() + " 已启动");

        // 初始化全局数据，例如加载字典、连接池等
        context.setAttribute("appName", "我的JavaWeb系统");
        context.setAttribute("onlineCount", 0);   // 在线人数初始值
    }

    @Override
    public void contextDestroyed(ServletContextEvent sce) {
        // 应用销毁时执行（服务器关闭或项目卸载）
        System.out.println("【应用销毁】系统正在关闭...");
    }
}

@WebListener
public class OnlineListener implements HttpSessionListener {

    @Override
    public void sessionCreated(HttpSessionEvent se) {
        // 新用户打开浏览器，Session 创建时
        ServletContext context = se.getSession().getServletContext();

        Integer count = (Integer) context.getAttribute("onlineCount");
        if (count == null) count = 0;
        count++;

        context.setAttribute("onlineCount", count);
        System.out.println("【在线人数 +1】 当前在线：" + count);
    }

    @Override
    public void sessionDestroyed(HttpSessionEvent se) {
        // Session 超时或 invalidate() 时
        ServletContext context = se.getSession().getServletContext();

        Integer count = (Integer) context.getAttribute("onlineCount");
        if (count != null && count > 0) {
            count--;
            context.setAttribute("onlineCount", count);
        }
        System.out.println("【在线人数 -1】 当前在线：" + count);
    }
}

当前在线人数：${applicationScope.onlineCount}

@WebFilter("/*")
public class PermissionFilter implements Filter {

    @Override
    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) resp;

        String uri = request.getRequestURI();

        // 1. 放行静态资源和登录相关
        if (uri.contains("/login") || uri.contains("/static/") 
            || uri.endsWith(".css") || uri.endsWith(".js") || uri.endsWith(".png")) {
            chain.doFilter(request, response);
            return;
        }

        // 2. 检查是否登录（结合之前的 LoginFilter）
        HttpSession session = request.getSession(false);
        if (session == null || session.getAttribute("user") == null) {
            request.setAttribute("errorMsg", "请先登录！");
            request.getRequestDispatcher("/login.jsp").forward(request, response);
            return;
        }

        // 3. RBAC 权限校验
        @SuppressWarnings("unchecked")
        List<String> userPermissions = (List<String>) session.getAttribute("userPermissions");

        // 假设权限存储为 URL 列表，如 ["/user/list", "/order/add"]
        boolean hasPermission = false;
        if (userPermissions != null) {
            for (String perm : userPermissions) {
                if (uri.contains(perm)) {
                    hasPermission = true;
                    break;
                }
            }
        }

        if (hasPermission || isAdmin(session)) {   // 管理员特殊放行
            chain.doFilter(request, response);
        } else {
            // 无权限
            if (request.getHeader("X-Requested-With") != null) {
                // AJAX 请求返回 JSON
                response.setContentType("application/json");
                response.getWriter().write("{\"code\":403,\"msg\":\"无权限访问！\"}");
            } else {
                request.setAttribute("errorMsg", "抱歉，您没有权限访问该页面！");
                request.getRequestDispatcher("/error/noPermission.jsp").forward(request, response);
            }
        }
    }

    private boolean isAdmin(HttpSession session) {
        // 简单判断是否为管理员角色
        return "admin".equals(session.getAttribute("userRole"));
    }
}

// 登录成功后
User user = ...;
List<String> perms = permissionService.getUserPermissions(user.getId());  // 查询数据库
session.setAttribute("user", user);
session.setAttribute("userPermissions", perms);
session.setAttribute("userRole", user.getRoleCode());